PT-2026-27785 · Kiteworks · Kiteworks

Published 2026-03-25 · Updated 2026-03-30 · CVE-2026-24750

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Kiteworks versions prior to 9.2.1

Description Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms, an authenticated attacker could exploit an Improper Neutralization of Input During Web Page Generation, resulting in Stored Cross-Site Scripting (XSS) when modifying forms. The issue occurs due to insufficient input validation during web page generation.

Recommendations Upgrade Kiteworks to version 9.2.1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-24750

Affected Products

Kiteworks

References · 4

• https://github.com/kiteworks/security-advisories/security/advisories/GHSA-rfwm-2hq6-h84g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24750 · Security Note
• https://twitter.com/infoflowcloud/status/2038620206990262758 · Twitter Post
• https://twitter.com/CVEnew/status/2038618165769298091 · Twitter Post